H?o j! 


NASA TECHNICAL 

MEMORANDUM 


NASA TM X-52845 


§ 

CM 

■v 

x 


< 

to 

< 



REQUIREMENTS, DESIGN, AND PERFORMANCE OF A 
CONTROL SYSTEM FOR A BRAYTON POWER SYSTEM 


by Ronald L, Thomas, Raymond S„ Bilski, and Robert A. Wolf 
Lewis Research Center 
Cleveland, Ohio 


TECHNICAL PAPER proposed for presentation at 
Fifth Intersociety Energy Conversion Engineering Conference 
sponsored by the American Institute of Aeronautics and Astronautics 
Las Vegas, Nevada, September 21-24, 1970 



REQUIREMENTS, DESIGN, AND PERFORMANCE OF A CONTROL 

SYSTEM FOR A BRAYTON POWER SYSTEM 

by Ronald L. Thomas, Raymond S. Bilski, and Robert A. Wolf 

Lewis Research Center 
Cleveland, Ohio 


TECHNICAL PAPER proposed for presentation at 

Fifth Intersociety Energy Conversion Engineering Conference 
sponsored by the American Institute of Aeronautics and Astronautics 
Las Vegas, Nevada, September 21-24, 1970 


NATIONAL AERONAUTICS AND SPACE ADMINISTRATION 



REQUIREMENTS, DESIGN, AND PERFORMANCE OF A CONTROL SYSTEM 
FOR A BRAYTON POWER SYSTEM 

by Ronald L. Thomas, Raymond S. Bilski, and Robert A. Wolf 
Lewis Research Center 

National Aeronautics and Space Administration 
Cleveland, Ohio 


Abstract 

The NASA Lewis Research Center is developing a Brayton Space 
Power System for future manned space missions. This paper dis- 
cusses the requirements, design, and performance of a Brayton con- 
trol system. The control system provides the controls and displays 
required for power system startup, shutdown, and steady -state oper- 
ation. Also provided is automatic power system protection in the 
event of engine malfunctions. 

The control system is designed for a minimum 5-year continuous 
operation. To achieve this, special circuits and redundancy have 
been included in the control system to insure continued safe power 
system operation even in the event of any single component failure. 
The control system consists of a signal conditioner connected to a 
control panel by a transmission cable. The signal conditioner mounts 
on the power conversion system and the control panel is located in a 
remote control room. 

One of the two systems delivered to NASA has successfully been 
used to operate a complete Brayton Power System for over 2000 
hours including 12 start-stop cycles. 

Introduction 

The NASA Lewis Research Center is engaged in a program to 
develop a Brayton power system capable of generating electric power 
in space. A current version of this power system is designed to de- 
liver 2 to 15 kilowatts of electric output power using a radioisotope 
as its heat source (Ref. 1). This Brayton power system with a 
simulated radioisotope heat source is undergoing performance and 
endurance tests at the Space Rawer Facility of the NASA Plum Brook 
Station. Preliminary results of these tests are reported in Ref. 2. 

All components and subsystems in this power system have as a de- 
sign objective a 5-year operating life. 

The Brayton program at the Lewis Research Center has empha- 
sized the complete system approach. The objective has been to as- 
semble and test a power system complete with all auxiliary subsys- 
tems required to operate as a self-contained unit. In this context, a 
control system was built to operate the power system during testing 
and at the same time to be evaluated as a subsystem of the power 
system. 

The control system performs the functions of startup, shutdown, 
power level control, electrical bus protection, malfunction monitor- 
ing, and emergency shutdown. It was a goal of the design that all 
circuits and control concepts were to be directly applicable for future 
long-term space missions. 

The Brayton control system consists of two separate compo- 
nents: a remote control panel and an engine mounted signal condi- 
tioner. The remote control panel contains the displays, alarms, 
manual controls, and automatic controls required to operate the 
Brayton power system. The signal conditioner operates on all sig- 
nals passing between the remote control panel and the power system. 
It conditions all signals to a 0 to 5 volt range. The signal conditioner 
is mounted on one of the engine cold plates. A hard -wired cable sys- 
tem links the control panel to the signal conditioner. 

This paper presents a description of the Brayton power system, 
the control system requirements, and the design that evolved. Also 
included are the results of test experience with two delivered control 
systems and suggested areas of improvement. For a detailed de- 
scription of the control system the reader is referred to the contrac- 
tor final design report by AiResearch Manufacturing Company 
(Ref. 3). 


Brayton Power System Description 

In order to understand the requirements placed upon the Brayton 
control system a brief review of the power system is presented. 
Figure 1 is a schematic diagram of the Brayton power system. A 
detailed description of the BPS can be found in Ref. 4. The system 
consists of a gas filled power conversion loop, a liquid filled heat 
rejection loop, a gas management subsystem and an electrical sub- 
system. The following paragraphs contain a brief description of each 
of these subsystems. 

Gas Filled Power Conversion Loop 

The working fluid of the gas filled power conversion loop is a 
mixture of helium and xenon gases at the molecular weight of krypton 
(83.8). This closed gas loop consists of the Brayton Rotating Unit 
(BRU), heat source heat exchanger, recuperator, waste heat ex- 
changer, and the required gas ducting. The flow path of the gas is 
indicated in Fig. 1. The BRU consists basically of a radial inflow 
turbine, a four -pole alternator, and a radial outflow compressor, all 
of which are mounted on a common shaft. The shaft rotates at 38,000 
rpm and is supported on gas-lubricated bearings. 

Heat Rejection System 

A silicone liquid, Dow -Corning 200, is circulated through three 
parallel paths to remove heat from the Brayton waste, heat exchanger, 
to cool the alternator, and to cool the system’s electrical packages 
which are mounted on coldplates. This waste heat is rejected to 
space through a radiator. For added reliability, two identical cool- 
ing loops are available, each with its own pump. During normal 
operation, one loop is active with the other in a passive standby 
mode. 

Gas Management Subsystem 

The gas management subsystem supplies gas for BPS startups, 
for hydrostatic support of the BRU gas bearings, and for gas loop 
pressure adjustments. It consists of a gas storage bottle, a gas 
bottle heater, a pressure regulator, nine solenoid valves, and con- 
necting lines to the gas loo£. The nine solenoid valves are the injec- 
tion valve (V-l), makeup valve (V-7), vent valve (V-2), bleed valve 
(V-3), check valve pilot valve (V-4), and four valves (V-5, V-G, V-8, 
and V-9) for controlling flow to the gas bearings. 

Electrical Subsystem 

The electrical subsystem contains all the electrical hardware 
necessary to operate the BPS. A separate presentation describing 
the electrical subsystem in detail is given in Ref. 5. This subsystem 
comprises: (1) the BRU speed control; (2) the alternator voltage 
regulator; (3) the do power supply which supplies all BPS dc power 
requirements; (4) two inverters, one for each liquid pump motor; 
and (5) the Brayton engine control system (BCS) which provides all of 
the control logic and conditioning functions required by the BPS and 
interfaces with all other active components (i.e. , valves, relays, 
instrumentation, and protective devices). 

Control System Requirements 

Prior to final definition of the Brayton control system design, it 
was necessary to outline basic system requirements. This section 
is structured so as to acquaint the reader with the concepts which 
were used at that time to formulate the design. 

General Requirements 

The control system for the Brayton Power System (BPS) must be 
designed in such a manner so as to provide all of the controls, pro- 
tective logic and displays necessary to operate the system. The con- 
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trol system must be an integral element of the BPS and as such oper- 
ate directly from BPS dc power. The control system is used during 
ground tests of the BPS but all control concepts and circuit designs 
used in the control system must be directly applicable to future long- 
term space missions. 

A major effort must be made to design reliability into the control 
system. The control system must, as a goal, be capable of operating 
the BPS continuously for 5 years. The control system must be de- 
signed so that a failure of any one part in the control system will not 
result in loss of BPS output power. 

The control system must contain a remote control panel which 
would be located inside the spacecraft during a space mission. 
Therefore an attempt must be made to build a compact control panel. 
Due to facility ground test constraints the control panel must be capa- 
ble of controlling the BPS from a maximum distance of 400 feet. All 
signals between the control panel and the BPS must be standardized 
to 0 to 5 volt range to minimize noise and facilitate the future use of 
standard telemetry and/or multiplex systems. All control panel dis- 
plays must be accurate to within ±2 percent of full scale. 

Because the control system is to be used during development 
tests of the BPS, it is necessary to provide displays of additional BPS 
measurements. These parameters must be displayed on a monitor 
panel which will be located adjacent to the remote control panel. 

Control Functions 

In simplest terms, the control system functions are to start up 
the BPS, to control it during steady-state operations, and to shut it 
down (Fig. 2). The following paragraphs describe these functions in 
more detail. 

Startup . The startup technique used during the initial phases of 
the 2 to 15 kWe BPS tests is a gas injection startup. Basically, this 
starting scheme consists of forcing gas from a high pressure storage 
bottle through the BRU turbine and overboard through a vent valve. 
This causes the BRU to spin. When the BRU reaches a self- 
sustaining speed the injection flow is stopped and the vent valve is 
closed. The BRU then bootstraps itself up to design speed using the 
gas which has been trapped in the system at the end of the injection 
period. After the BRU has reached design speed the gas pressure in 
the loop is adjusted to its desired value depending upon the desired 
power level of the BPS. 

The startup procedure outlined above consists of nine major 
steps which must be performed in a definite sequence. The timing 
between some of the steps is very critical. Failure to follow the 
proper sequence of steps could result in an aborted startup or dam- 
age to the BPS. 

A start module is included in the control panel whose function is 
to assist the operator during the crucial startup period. The start 
module must meet the following requirements: (1) it must bring to- 
gether in one place all the information the operator needs to start the 
engine; (2) it must keep track of the engine status and inform the 
operator of this status; (3) it must prohibit the operator from mis- 
takenly violating the proper sequence of events; and (4) it must per- 
form the most critical startup steps automatically. 

Steady -state . During normal steady -state operation the only 
automatic control required of the control system is that of gas inven- 
tory control. This control is to automatically compensate for the 
rise in gas loop pressure as the engine heats up following startup and 
to compensate for minor leaks in the gas loop during long-term oper- 
ation. The operator must be able to set the desired BPS gas pres- 
sure level from the control panel. 

The only other steady-state controls required by the BPS are 
regulation of BRU speed and regulation of alternator output voltage. 
These controls are contained in the electrical control package of the 
electrical subsystem. 

In addition, the control system must provide the operator with 
manual controls for all BPS control devices and furnish him with the 
status of the BPS at all times. 


Shutdown . The BPS shutdown procedure consists primarily of 
turning off the heat source, providing hydrostatic gas for the BRU 
bearings, and applying an electrical load to the BRU alternator. This 
causes the BRU to decelerate down to zero speed. The entire proce- 
dure consists of seven major steps. As was the case with the BPS 
startup, these steps must be performed in a definite sequence. A 
module, identical in concept to the startup module, is required to as- 
sist the operator during shutdown. 

Protection Considerations 

The control system must protect the BPS and its surrounding en- 
vironment during BPS malfunctions, but shall permit continued power 
system operation if at all possible. Automatic control action is to ho 
utilized when very quick corrective or protective action is required 
(Fig. 3). For example, should the BRU begin to overspeed, correc- 
tive action must be taken immediately (within 1 sec). If this correc- 
tive action fails, the BPS must immediately be shut down (within a 
few seconds). In this case automatic action is manditory. 

Automatic protective circuitry must be included for the following 
conditions: (1) BRU over speed and under speed; (2) gas loop over- 
pressure and underpressure; (3) bearing cavity underpressure; (4) 
gas loop overtemperature; (5) alternator overvoltage and undervolt- 
age; and (5) alternator overcurrent. All control actions shall be ac- 
companied by alarms which tell the operator what has occurred. 
Provision must be made so that all of the protective circuits can be 
overriden manually by the operator from the control panel. 

In order to insure long-term uniterrupted BPS operation, the 
control system must contain self-checking circuitry. In cases of 
failures of the automatic circuitry, the self -checking circuitry must 
inhibit the automatic action and notify the operator of the failure by 
means of an alarm. The operator must, where possible, be able to 
replace or repair the failed circuit without causing a BPS shutdown. 

Control System Design 

A control system which meets all the requirements for control- 
ling the BPS has been designed and built. This control system con- 
sists of a signal conditioner connected to a control panel by a trans- 
mission cable (Fig. 4). The signal conditioner is mounted on a BPS 
cold plate and the control panel is located in a remote control room. 
The control system design is discussed in the following sections. 

Reliability 

To meet the reliability requirements the following guidelines 
were utilized in designing the control system circuits: only solid 
state devices and integrated circuits were used; all circuit compo- 
nents were sized to operate in derated modes; and a detailed thermal 
analysis was performed on the signal conditioner design to insure 
that all components operate within their temperature specifications. 

A failure mode analysis was conducted to determine the level of 
redundancy and preferred failure modes for each BPS control device. 
In those cases where control devices were used only as a backup, no 
redundancy was provided. Other devices having preferred failure 
modes were provided with either series or parallel redundancy. For 
very critical control devices both series and parallel redundancy 
were provided; this permits normal operation of the device even if a 
component failure were to occur. 

After each control circuit was designed, a failure mode effects 
analysis was conducted on it. Every component was examined to de- 
termine if its failure could result in loss of BPS power output. If 
such a failure could occur the circuit was redesigned. 

Signal Conditioner 

A signal conditioner package was designed to meet the require- 
ment that all signals between the BPS and the control panel must be 
0 to 5 volts. This package is mounted on a fluid-cooled heat sink 
(cold plate) on the BPS frame (Fig. 5) and is designed to meet the 
environmental specifications of the BPS (Ref. 6). 

The signal conditioner provides conditioning for all the BPS sig- 
nals to the control and the monitor panels. These signals are: 
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33 temperature measurements; 13 pressure measurements; 6 flow 
rate measurements; and 23 electrical measurements. The signal 
conditioner also conditions all command signals from the control 
panel to the BPS. 

Besides conditioning signals to and from the BPS, the signal con- 
ditioner serves as a junction box. All dc power leads, commons, 
and direct wired valve and relay position indicators are wired through 
the signal conditioner. The signal conditioner operates directly from 
BPS ± 28 volt dc power and requires approximately 140 watts of con- 
tinuous power. 

Mechanical Design . The signal conditioner is a welded aluminum 
chassis 8- by 14- by 25 inches weighing 80 pounds and is shown in 
Fig. 6. The chassis has provision for 21 printed circuit cards 5- by 
10 inches, although only 19 cards are used. A typical P.C. card is 
shown in Fig. 7. Metal heat sinking frames are provided on these 
cards to aid in conducting internal heat from the components to the 
coldplate. Provision has also been made to cover these boards with 
a potting compound to aid in removing heat. 

Connectors are provided at each end of the chassis. Sixteen con- 
nectors on one end interface with the engine and 11 on the other end 
interface with the control panel. Two additional connectors on the 
control panel side are used for test points. By making measure- 
ments at these two connectors it is possible to check all redundancy 
in the signal conditioner without opening the package. 

Circuits . Twelve types of circuits were developed to meet the 
signal conditioner requirements. These circuits fall into the two 
major classifications of sensing circuits and control circuits. 

For the thermocouple inputs it was necessary to provide a refer- 
ence temperature. Thermistor controlled ovens were developed for 
this purpose. These ovens within the signal conditioner maintain a 
reference temperature of 100°±0.5° C. 

The signal conditioner also contains triply redundant emergency 
shutdown circuits. These are the only circuits with logic control 
functions in the signal conditioner. These circuits are actuated by a 
115 percent BRU overspeed signal or by a manually operated switch 
on the control panel. All circuits for control devices used during an 
emergency shutdown contain special override logic. The outputs of 
the emergency shutdown circuits tie into this override logic to oper- 
ate the valves, relays, etc. Two out of three of the emergency shut- 
down circuits must agree before an emergency shutdown is initiated. 
The emergency shutdown takes precedent over all other signals, i. e., 
valves, relays, etc. cannot be controlled from the control panel dur- 
ing an emergency shutdown. 

Redundancy . To achieve reliable control system operation, 
several forms of redundancy are designed into the signal conditioner. 
First, the input receiver amplifier for every driver circuit is of a 
differential type; that is, two signals must be available to operate 
the driver. 
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When preferred failure modes are clearly dictated, dual redun- 
dant circuits are used. Depending on the preferred failure mode, the 
dual drivers are operated in series or parallel. For critical circuits, 
triple redundant drivers are used. The triple redundant drivers pro- 
vide normal operation even in the event of a driver failure. These 
triple redundant drivers are used for operating the critical jacking 
gas valves and the gas loop vent valve. 

The redundancy discussed above is carried back through the 
power supplies. These are three +10 volt dc, three -10 volt dc, and 
three +5 volt dc power supplies in the signal conditioner. These sup- 
plies operate from BPS ±28 volt dc power. If a +10 volt power supply 
should fail, for example, all triply redundant control circuits would 
still operate and all dual redundant circuits connected to that power 
supply would fail in the preferred mode. 

Transmission System 

It was decided that the simplest and most reliable interface be- 
tween the control panel and signal conditioner for ground development 
tests would be a direct wired cable system. This cable system con- 
sists of 11 cables with a total of 314 conductors. The weight of this 
cable is approximately 4.8 pounds per foot. This cable system is 
designed to meet the environmental specification of the BPS (Ref. 6). 

Control and Monitor Panels 

The control panel provides the operator with the BPS status, 
automatic protection and control, and manual controls. The monitor 
panel provides displays and alarms for BPS parameters that are not 
displayed on the control panel. The control and monitor panels are 
contained in one console (Fig. 8). This console contains a card file 
with 77 printed circuit cards for all the electronic components, and a 
calibrate r-testor for adjusting and checking all circuits on these 
cards. An example of these printed circuit cards is shown in Fig. 9. 
Four designs make up 47 of the 77 printed circuit cards in the control 
panel. The control panel circuits are supplied by primary and back- 
up ±15 and +5 volt dc power supplies. These power supplies operate 
from BPS ±28 volt dc power. The control panel requires approxi- 
mately 130 watts of BPS ±28 volt dc power. 

The control panel circuits were designed for ease of replacement 
and interchangeability. Because the control panel might be located in 
a spacecraft, its circuits will be accessible. The ability to replace 
failed circuits increases the probability of success for a long-term 
space mission. 

Control Panel Modules . The control panel consists of 11 com- 
pact modules. Each module contains automatic logic, manual over- 
ride switches, meters, position indicating flags, and alarm lights. 
These panels also display appropriate subsystem graphics to aid the 
operator in the BPS operation. 

Start Module . The start module shown in Fig. 10 provides the 
operator with a safe sequence for starting the BPS. When the opera- 
tor has correctly completed a pre start check list he can initiate the 
power system startup. The control system automatically controls 
the necessary control devices to start the BPS. During startup the 
operator is informed of all control actions and valve positions by 
means of indicating flags on the start panel. A final flag confirms 
that startup is complete after the operator has completed his check- 
list. 


Stop Module . The stop module (Fig. 10) provides the operator 
with a safe procedure for shutting the BPS down. This procedure 
consists of: placing all control panel switches in the correct posi- 
tion; cooling the heat source down; applying hydrostatic gas; and 
applying parasitic load to the alternator. After the BRU has been 
safely shutdown the stop module provides indication to inform the 
operator that he has completed his check list correctly. 


For example, when the control device is off (normal operation) the 
minus input is high and the plus input is low. Before the driver can 
be turned on, the plus lead must be high and the minus must be low. 
Two highs or two lows result in the driver turning the control device 
off (normal condition) thus preventing a single failure from causing a 
driver to operate. 


Liquid loop Module . The liquid loop module (Fig. 11) provides 
the operator with manual control of each pump. Alarms and read- 
outs for each of the liquid loop flows and hot-spot temperatures are 
also provided. 

Gas Inventory Module . The gas inventory module (Fig. 11) pro- 
vides automatic control and protection for the BPS gas loop. The 


3 





automatic control consists of pressure level control. The operator 
can select a pressure setpoint on the gas inventory module panel for 
compressor discharge pressure. Automatic control logic then oper- 
ates a small makeup valve and a small bleed valve to control gas loop 
pressure within ±0.5 psia of the setpoint. Indicating flags on the 
panel inform the operator when a valve is open and which valve it is. 

A continuous operation alarm informs the operator when either of the 
valves is opened for longer than 60 seconds indicating a possible leak 
in the gas loop. 

This module also provides protection for the BPS if the gas loop 
pressure exceeds 62 psia. If a large gas leak develops from the gas 
management subsystem into the gas loop, pressure switches sense 
the overpressure. These pressure switch closures cause the control 
logic to operate the vent valve to keep the BPS pressure at a safe 
level. 

Critical Parameters Module . The purpose of the critical param- 
eters module (Fig. 12) is to give the operator a snapshot view of the 
BPS status. A five-digit display is provided for BRU speed. Three 
dual scale meters are provided for key BPS pressures and tempera- 
tures. Also provided are alarms for critical temperatures, over and 
under speeds, and control panel power supply malfunctions. 

Emergency Shutdown Module . The emergency shutdown module 
(Fig. 12) provides the operator with the means for manually shutting 
the BPS down quickly but safely. This module contains the shutdown 
switch, flags for indicating to the operator the status of key control 
devices during a shutdown, and a shutdown alarm. 

Gas Bearing Module . This module (GBM) is also shown in 
Fig. 12. The purpose of this module is to provide protection for the 
BRU gas bearings during operation. The bearings normally operate 
hydro dynamic ally on the gas in the alternator cavity. However, if 
this pressure gets too low or BRU speed gets too low, these bearings 
lose their load carrying capability. Under these conditions the bear- 
ings can be safely operated if they are pressurized from an external 
source. The GBM monitors cavity pressure and BRU speed and sup- 
plies gas to the bearings automatically whenever speed or pressure 
is low. 

Heat Source Module . The heat source module (HSM) also shown 
in Fig. 12 interfaces the control system with the electric heat source. 
The HSM provides BPS protection by shutting off the electric heat 
source if the compressor inlet temperature gets too high or if there 
is an emergency shutdown. This module will require modification 
when the BPS is mated to a radioisotope heat source. 

Valve Control Module . The valve module (VM) shown in Fig. 13 
provides the operator with: the manual control switches for all the 
valves; flags for indicating positions of all valves and pressure 
switches; meters and alarms for gas bottle supply temperature and 
pressure; and a variable setpoint control for the gas bottle pressure 
alarm. Also the VM contains a graphic display showing concisely 
how ail the valves, pressure switches, and gas supplies are located 
in the BPS. 

The valve control switches all have close, automatic, and open 
positions. Since manual operation of these switches disconnects all 
automatic control connected to a particular valve, each switch must 
be pushed in before it can be turned. This is to remind the operator 
that he is removing all automatic control from any valve he operates 
manually. 

Electrical Control ac . The ac electrical control module is shown 
in Fig. 14. This module provides the operator with all the BPS ac 
readouts, alarms, and manual controls. This module also provides 
several automatic control and protection features. 

The readout includes the alternator phase voltages, phase cur- 
rents, power, and field currents. Also displayed is the power sup- 
plied the user. Alarms are provided for over and under alternator 
voltages, high phase currents, and failure of module circuitry. Man- 
ual control switches allow the operator to connect or disconnect the 
user’s load from the alternator, flash the alternator field, operate 
the alternator field from a backup power source, and override the 
speed control channels full on or full off. 


Automatic control removes the user's load from the alternator if 
the BRU goes under speed or if any phase current exceeds 150 per- 
cent of design. Load is added to the alternator if the BRU speed ex- 
ceeds 105 percent of design. Automatic control is also provided to 
switch the alternator field to a backup supply if the alternator voltage 
goes high or low. 

Electrical Control dc . The dc electrical module shown in Fig. 15 
provides the operator with dc electrical displays, alarms, and over- 
rides. The dc displays include the battery voltages, currents, status 
and temperatures, and the dc bus voltages and currents. The alarms 
warn the operator of a high or low dc bus voltage or a low battery 
voltage . 

Manual override is provided for the operator to connect or dis- 
connect the battery from the dc bus. This allows the battery to be 
disconnected after BPS shutdown to prevent battery leakage and 
allows reconnection of the battery prior to BPS startup. Manual 
overrides are also provided for commanding the battery chargers on 
or off and for supplying power to the gas bottle heater. 

Monitor Panel . The monitor panel (Fig. 16) is an auxiliary panel 
to the control panel for use only during development tests of the 
power system. The monitor panel provides no automatic control or 
protection. Its two main functions are: (1) supply the operator with 
additional readout and alarms not available on the control panel; and 
(2) provides output buffering of all control panel signals to bo used 
with a digital data acquisition system. All signals used in the moni- 
tor panel from the control panel are routed through isolation ampli- 
fiers. This prevents monitor panel electrical failures from affecting 
the signals used for control of the BPS. Since the monitor panel is 
designed only for development tests and would not be used for a space 
mission, it does not operate from the BPS ±28 volt power. All moni- 
tor panel power comes from the 110 volt ac test facility power sys- 
tem. 

Special Circuit Designs . All critical BPS signals are triply re- 
dundant from the engine through the signal conditioner to the control 
panel. To check these triply redundant analog signals an analog se- 
lector circuit was developed. The analog select circuit is designed 
to prevent incorrect control action from being taken on an erroneous 
analog signal. The analog selector compares the three signals 
against each other and rejects one if it does not agree with the other 
two. The amount of allowable error among the three signals is ad- 
justable. The analog selector circuit also issues an alarm signal to 
the operator to notify him when there is a discrepancy among the 
triply redundant signals. 

The 0 to 5 volt analog signals are required to be accurate to 
within ±2 percent of full scale. These signals are transmitted from 
the signal conditioner to the control panel by means of a cable that 
may be up to 400 feet in length. To prevent voltage drops in the 400- 
foot ground returns from causing signal errors: a special differential 
analog receiver circuit is used; and all analog signal returns are 
referenced at one point in the signal conditioner and at one point in 
the control panel. A differential analog receiver is then used to cor- 
rect the analog signals at the control panel for the difference in volt- 
age between these two ground points. 

Performance 

Two control systems have been built to date. Both of these con- 
trol systems have gone through extensive acceptance testing. The 
first system is now being used to control a BPS during development 
tests. The second system is being evaluated as part of a Bray ton 
electrical subsystem test. This section discusses the acceptance 
tests performed on the two control systems and the success of the 
first control system in controlling the BPS. 

Acceptance Te sling 

After assembly of each Brayton control system and prior to ship- 
ment to NASA an extensive checkout was conducted. The signal con- 
ditioner was ope rated over a range of temperatures and under vacuum 
conditions. It was necessary to design and fabricate a load simulator 
to check all the control system functions. This load simulator is a 
device which electrically simulates all BPS instrumentation and con- 
trol devices. 
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Both control systems successfully completed all parts of the ac- 
ceptance test. Minor problems occurred during checkout and these 
problems were corrected as discovered. Two of these problems are 
worth mentioning. The thermocouple signal conditioners were found 
to be sensitive to high frequency noise. When not subjected to high 
frequency noise the circuits meet all required specifications. Meth- 
ods of modifying these circuits to eliminate noise sensitivity are be- 
ing evaluated. The thermocouple noise sensitivity became apparent 
because of a problem in the signal conditioner power supplies. The 
originally designed switching regulator power supplies were very 
noisy and were causing excessive noise in the analog signal chan- 
nels. As a temporary solution low noise, series -regulator power 
supplies were fabricated by NASA. These supplies are presently 
being used for BPS development tests. Low noise, high efficiency 
replacement supplies are presently being built to solve this problem 
permanently. 

Brayton Power System Tests 

Following delivery of the control system to the NASA Space 
Power Facility in Sandusky, Ohio on May 6, 1969, the control system 
was installed as part of the BPS. The control system again under- 
went a checkout. This time, the system's interfaces with the rest of 
the Brayton hardware and the digital data acquisition system was 
checked. Several minor problems were uncovered and corrected at 
this time. Having passed these tests, the control system was ready 
for the first BPS startup. Figure 17 is a summary of the control 
system performance during BPS testing. 

As of this writing, the Brayton control system has logged ap- 
proximately 3000 hours of operation. This time includes approxi- 
mately 2000 hours of use controlling the BPS during development 
tests. The control system has been used for startup and shutdown of 
the BPS 12 times. 

The automatic control and protection circuits have operated 
successfully a number of times. On one occasion too much vehicle 
load was applied to the alternator and the BRU speed began to de- 
crease. However, at 90 percent of design speed the control panel 
logic automatically removed the vehicle load and applied hydrostatic 
gas to the BRU bearings. This action allowed the BPS to return to 
design point operation and prevented a BPS shutdown. 

The automatic gas pressure regulation provided by the gas in- 
ventory module has also been used extensively to control gas loop 
pressure to within 0.5 psia of the desired value. A small gas leak 
developed in the electrically simulated isotope heat source . The con- 
trol system automatically cycled the makeup valve several thousand 
times during the endurance tests to maintain the desired gas loop 
pressure. 

The BPS parameters displayed on the control panel have enabled 
the operator to determine the exact status of the BPS at all times. 

In addition, the control system is the prime source of all electrical 
system data taken during the development runs. 

Two problems have been encountered during BPS operation that 
have resulted in design efforts to modify control system circuitry. 

One problem occurred during early startup attempts. During BPS 
startup, pressure fluctuations in the gas management system caused 
the pressure switches in die gas bearing supply lines to make and 
break contact repeatedly. These pressure fluctuations were unanti- 
cipated and therefore not accounted for in the startup logic. This 
disturbance caused the startup logic to "repeat itself" and resulted 
in an aborted startup. The temporary solution to the problem was to 
switch the starting logic off immediately after gas injection cutoff. 
This permitted a proper BPS start. A better solution involves a re- 
design of the starting logic taking into account the effects of these 
pressure fluctuations. This has been done and is presently in the 
checkout stage. 

The second problem occurred because of the BRU speed sensing 
circuits in the signal conditioner. These circuits convert the alter- 
nator output frequency into an analog voltage proportional to speed. 
However, for frequencies above 120 percent of design the circuit out- 
puts fold-back. Figure 18 shows indicated BRU speed from these 
circuits versus actual BRU speed. 


During one of the research runs, a short occurred among all 
three phases of the Brayton alternator. This resulted in a distorted 
alternator output voltage waveform which appeared to the inputs of 
the speed circuits as a large over speed. Because the shorted alter- 
nator effectively had no load, the BRU began to over speed. The 
speed sensing circuits, because of the fold -back characteristics, 
detected no overspeed; in fact, the output of the speed circuit was 
that of a "low" speed (see Fig. 18). As a result, no over speed sig- 
nal (115 percent of design) was available for actuating the emergency 
shutdown and the BRU being tested at the time was damaged by over - 
speed. The speed circuits are under investigation so modifications 
can be made to prevent them from folding back. 

Concluding Remarks 

This paper has discussed the requirements, design, and perfor- 
mance of a control system for a Brayton power system. Two of 
these control systems have been built and tested. The first one is 
being used to control a Brayton power system during development 
testing, and the second is being evaluated in an electrical subsystem 
test. The control system consists of an engine mounted signal condi- 
tioner, connected to a remote control panel by a transmission line. 
The signal conditioner meets the power system environment require- 
ments of vacuum, temperature, and radiation. The control panel is 
designed to operate in a control room environment. 

The control system provides power system startup and shutdown 
logic, automatic control and protection, signal conditioning of all 
power system transducers, system status, and automatic and manual 
control of all power system hardware. The control system is de- 
signed to provide these functions for 5 years or longer. This is ac- 
complished by using the latest state-of-the-art integrated circuits 
and providing redundancy of all critical control circuits. A major 
effort was incorporated in the design to make the control system 
tolerant to failures; individual components may fail, but no single 
failure will cause the Brayton power system to be unable to produce 
usable electric power. 

An effort was made to make the control panel modular and to 
provide interchangeability of circuits. A failed circuit can be re- 
placed without shutting the power system down . The signal condi- 
tioner, however, was designed for unattended engine operation and is 
to operate for 5 years or more without maintenance. 

Depending on the mission, the electrical packages on the engine 
may or may not be accessible. If it is at all possible to provide ac- 
cessibility to this equipment it should be done. The ability to period- 
ically check all circuits for failures and to replace a failed circuit 
easily would certainly increase the probability for success of a long- 
term space mission. 

The transmission system connecting the signal conditioner and 
the control panel consists of 11 cables. For a future system a single 
wire multiplexer system with hard-wired overrides may provide the 
required reliability at much less weight. The control panel and sig- 
nal conditioner interfaces are all 0 to 5 volts to facilitate such a de- 
sign. 

An effort was made to design the control panel compactly. How- 
ever, now that initial ground development testing of the Brayton 
power system has been completed, data channels, alarms, and dis- 
plays which are not absolutely essential to the power system opera- 
tion could be removed from the control panel. Also, the tested power 
system startup and shutdown procedures can now be designed to be 
completely automatic. These changes will result in a more compact, 
reliable, and lighter weight control panel. 

One of these control systems has successfully started the 
Brayton power system, presently under evaluation, 12 times and has 
provided all power system control and protection for approximately 
2000 hours. 

In summary, the control system discussed in this paper has been 
successful in controlling a Brayton power system. Control concepts 
and circuits have been developed that are directly applicable for 
future space power systems. 
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Figure 1. - Schematic diagram, Brayton power system. 


CONTROL FUNCTIONS 


BPS STARTUP 
BPS SHUTDOWN 

GAS LOOP PRESSURE LEVE CONTROL 
MANUAL CONTROL OF ALL BPS CONTROL DEVICES 
BPS STATUS 

Figure 2. - Brayton control system control functions. 
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PROTECTION CONSIDERATIONS 


BRU OVERSPEED AND UNDERSPEED 
GAS LOOP OVER AND UNDER PRESSURE 
BEARING CAVITY UNDER PRESSURE 
GAS LOOP OVER TEMPERATURE 
ALTERNATOR OVER AND UNDER VOLTAGE 
ALTERNATOR OVERCURRENT 
ALARMS FOR OUT-OF-TOLERANCE CONDITIONS 
ALARMS FOR FAILED CIRCUITRY 

Figure 3. - Brayton control system protection 
functions. 
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Figure 4. - Brayton control system. 
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Figure 7. - Typical signal conditioner printed circuit card 
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Figure 8. - Control and monitor panels in control system console. 
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Figure 12. - Critical parameters, emergency shutdown, gas bearing, 
and heat source modules. 



Figure 13. - Value control module. 
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CONTROL SYSTEM PERFORMANCE 


12 BPS STARTUPS AND SHUTDOWNS 
2000 HOURS OF BPS OPERATION 
PROTECTED BPS DURING OVERLOAD 

JS OPERATED PRESBURE LEVEL CONTROL SEVERAL THOUSAND TIMES 

w TO MAINTAIN GAS LOOP PRESSURE 

w PROBLEMS WITH BRU SPEED SENSING CIRCUIT 

Figure 17. - Control system performance during BPS testing. 



Figure 18. - Signal conditioner speed circuit characteristic. 
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